Following the British Airways data breach in 2018, where almost 500,000 customers were affected, the Information Commissioners Office (ICO) has issued its final fine. The BA data breach fine was announced to be just \u00a320 million – a significant 90% less than the initial proposed intention to fine last year of \u00a3183m.<\/p>\n
Though \u00a320 million is no small amount, for the international airline, the question is whether this data breach fine is enough to have a proper impact. In terms of how the ICO decides how much it should fine data breach offenders, it should be enough to have a \u2018dissuasive effect\u2019 on the company and others in order to warn them from committing further data breaches.<\/p>\n
In the case of the BA data breach fine, it is not seen as a high enough amount to have a dissuasive effect when you consider how much of the original proposed amount has been wiped out.<\/p>\n
<\/p>\n
The British Airways data breach occurred in 2018, affecting customers who made or changed a booking between 10:58pm on 21st<\/sup> August 2018 and 9:45pm on 5th<\/sup> September 2018. British Airways announced that customers who made a reward booking between\u00a021st April 2018 and 28th July 2018\u00a0could also be affected.<\/p>\n The data breached included: names, travel information, email addresses, billing addresses, and payment card details, including the CVV number on the back of the card in some cases. This information is extremely sensitive and was available for over two weeks during the attack before the issue was identified.<\/p>\n The sensitive nature of the BA data breach leaves victims immediately vulnerable to fraud, scams and identity theft. Victims are eligible to claim compensation if they have been affected by the breach, with eligible victims able to sign-up via the BA Group Action website here<\/strong>.<\/p>\n The BA data breach fine was originally announced as an intention to fine them \u00a3183 million by the ICO. However, they have now deemed a much more minimal amount to be enough in the sum of \u00a320 million. We assume that this means that the ICO believes this much smaller amount to be enough to have a dissuasive effect, although we are concerned at how much the fine has come down by. After investigation, the ICO concluded that BA should have identified the security weakness and put preventative measures in place, so this was a preventable incident either way.<\/p>\n It is likely that the fine may have been dramatically reduced due to the impact of the coronavirus pandemic, which has triggered a significant decline in services in the aviation industry. Some form of impact was to be expected, but the 90% drop in the BA data breach fine has raised significant concerns in terms of upholding important data protection laws, and how offenders are to be held accountable. Such a small fine threatens to undermine the power of the GDPR and may not act as a deterrent to big businesses who may not bother to put high data security measures in place when they could end up arguing for far smaller penalties.<\/p>\nThe BA data breach fine<\/strong><\/h3>\n
Join the BA Group Action now<\/strong><\/h3>\n